GnuTLS: Clarify the use of SSLKEYFILE
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
f20cfa4a
JH
70#if GNUTLS_VERSION_NUMBER >= 0x03010a
71# define SUPPORT_GNUTLS_SESS_DESC
72#endif
4d2a62a3
JH
73#if GNUTLS_VERSION_NUMBER >= 0x030300
74# define GNUTLS_AUTO_GLOBAL_INIT
9f707b89 75# define GNUTLS_AUTO_PKCS11_MANUAL
4d2a62a3 76#endif
97277c1f
JH
77#if (GNUTLS_VERSION_NUMBER >= 0x030404) \
78 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
79# ifndef DISABLE_OCSP
80# define EXIM_HAVE_OCSP
81# endif
82#endif
f20cfa4a
JH
83#if GNUTLS_VERSION_NUMBER >= 0x030500
84# define SUPPORT_GNUTLS_KEYLOG
85#endif
47195144
JH
86#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
87# define SUPPORT_SRV_OCSP_STACK
88#endif
49132a3b
JH
89#if GNUTLS_VERSION_NUMBER >= 0x030600
90# define GNUTLS_AUTO_DHPARAMS
91#endif
be427508 92#if GNUTLS_VERSION_NUMBER >= 0x030603
e326959e 93# define EXIM_HAVE_TLS1_3
be427508 94# define SUPPORT_GNUTLS_EXT_RAW_PARSE
e326959e 95# define GNUTLS_OCSP_STATUS_REQUEST_GET2
be427508 96#endif
c0635b6d
JH
97
98#ifdef SUPPORT_DANE
99# if GNUTLS_VERSION_NUMBER >= 0x030000
100# define DANESSL_USAGE_DANE_TA 2
101# define DANESSL_USAGE_DANE_EE 3
102# else
103# error GnuTLS version too early for DANE
104# endif
105# if GNUTLS_VERSION_NUMBER < 0x999999
106# define GNUTLS_BROKEN_DANE_VALIDATION
107# endif
899b8bbc 108#endif
7e07527a 109
43e2db44
JH
110#ifdef EXPERIMENTAL_TLS_RESUME
111# if GNUTLS_VERSION_NUMBER < 0x030603
112# error GNUTLS version too early for session-resumption
113# endif
114#endif
115
f2de3a33 116#ifndef DISABLE_OCSP
2b4a568d
JH
117# include <gnutls/ocsp.h>
118#endif
899b8bbc
JH
119#ifdef SUPPORT_DANE
120# include <gnutls/dane.h>
121#endif
059ec3d9 122
f1be21cf
JH
123#include "tls-cipher-stdname.c"
124
125
b10c87b3
JH
126#ifdef MACRO_PREDEF
127void
128options_tls(void)
129{
130# ifdef EXPERIMENTAL_TLS_RESUME
131builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
132# endif
e326959e
JH
133# ifdef EXIM_HAVE_TLS1_3
134builtin_macro_create(US"_HAVE_TLS1_3");
135# endif
97277c1f
JH
136# ifdef EXIM_HAVE_OCSP
137builtin_macro_create(US"_HAVE_TLS_OCSP");
138# endif
139# ifdef SUPPORT_SRV_OCSP_STACK
140builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
141# endif
b10c87b3
JH
142}
143#else
144
145
17c76198 146/* GnuTLS 2 vs 3
059ec3d9 147
17c76198
PP
148GnuTLS 3 only:
149 gnutls_global_set_audit_log_function()
059ec3d9 150
17c76198
PP
151Changes:
152 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
153*/
059ec3d9 154
17c76198 155/* Local static variables for GnuTLS */
059ec3d9 156
17c76198 157/* Values for verify_requirement */
059ec3d9 158
e51c7be2 159enum peer_verify_requirement
899b8bbc 160 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 161
17c76198
PP
162/* This holds most state for server or client; with this, we can set up an
163outbound TLS-enabled connection in an ACL callout, while not stomping all
164over the TLS variables available for expansion.
059ec3d9 165
17c76198
PP
166Some of these correspond to variables in globals.c; those variables will
167be set to point to content in one of these instances, as appropriate for
168the stage of the process lifetime.
059ec3d9 169
b1a32a3c 170Not handled here: global tlsp->tls_channelbinding.
17c76198 171*/
059ec3d9 172
17c76198 173typedef struct exim_gnutls_state {
9d1c15ef 174 gnutls_session_t session;
17c76198 175 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 176 gnutls_priority_t priority_cache;
17c76198 177 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
178 int fd_in;
179 int fd_out;
bd95ffc2
JH
180
181 BOOL peer_cert_verified:1;
182 BOOL peer_dane_verified:1;
183 BOOL trigger_sni_changes:1;
184 BOOL have_set_peerdn:1;
185 BOOL xfer_eof:1; /*XXX never gets set! */
186 BOOL xfer_error:1;
187#ifdef SUPPORT_CORK
188 BOOL corked:1;
189#endif
190
5fd28bb8 191 const struct host_item *host; /* NULL if server */
afdb5e9c 192 gnutls_x509_crt_t peercert;
9d1c15ef
JH
193 uschar *peerdn;
194 uschar *ciphersuite;
195 uschar *received_sni;
17c76198
PP
196
197 const uschar *tls_certificate;
198 const uschar *tls_privatekey;
199 const uschar *tls_sni; /* client send only, not received */
200 const uschar *tls_verify_certificates;
201 const uschar *tls_crl;
202 const uschar *tls_require_ciphers;
e51c7be2 203
17c76198
PP
204 uschar *exp_tls_certificate;
205 uschar *exp_tls_privatekey;
17c76198
PP
206 uschar *exp_tls_verify_certificates;
207 uschar *exp_tls_crl;
208 uschar *exp_tls_require_ciphers;
55414b25 209 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 210#ifndef DISABLE_EVENT
a7538db1
JH
211 uschar *event_action;
212#endif
899b8bbc
JH
213#ifdef SUPPORT_DANE
214 char * const * dane_data;
215 const int * dane_data_len;
216#endif
17c76198 217
389ca47a 218 tls_support *tlsp; /* set in tls_init() */
817d9f57 219
17c76198
PP
220 uschar *xfer_buffer;
221 int xfer_buffer_lwm;
222 int xfer_buffer_hwm;
17c76198
PP
223} exim_gnutls_state_st;
224
225static const exim_gnutls_state_st exim_gnutls_state_init = {
b10c87b3 226 /* all elements not explicitly intialised here get 0/NULL/FALSE */
f2ed27cf
JH
227 .fd_in = -1,
228 .fd_out = -1,
17c76198 229};
83da1223 230
17c76198
PP
231/* Not only do we have our own APIs which don't pass around state, assuming
232it's held in globals, GnuTLS doesn't appear to let us register callback data
233for callbacks, or as part of the session, so we have to keep a "this is the
234context we're currently dealing with" pointer and rely upon being
235single-threaded to keep from processing data on an inbound TLS connection while
236talking to another TLS connection for an outbound check. This does mean that
237there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
238second connection.
239XXX But see gnutls_session_get_ptr()
240*/
059ec3d9 241
74f1a423 242static exim_gnutls_state_st state_server;
059ec3d9 243
49132a3b 244#ifndef GNUTLS_AUTO_DHPARAMS
17c76198
PP
245/* dh_params are initialised once within the lifetime of a process using TLS;
246if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
247don't want to repeat this. */
83da1223 248
17c76198 249static gnutls_dh_params_t dh_server_params = NULL;
49132a3b 250#endif
059ec3d9 251
dea4b568 252static int ssl_session_timeout = 7200; /* Two hours */
059ec3d9 253
fc243e94 254static const uschar * const exim_default_gnutls_priority = US"NORMAL";
83da1223 255
17c76198 256/* Guard library core initialisation */
83da1223 257
17c76198 258static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 259
4fb7df6d 260#ifndef DISABLE_OCSP
9196d5bf 261static BOOL gnutls_buggy_ocsp = FALSE;
e5489333 262static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
4fb7df6d 263#endif
9196d5bf 264
b10c87b3
JH
265#ifdef EXPERIMENTAL_TLS_RESUME
266static gnutls_datum_t server_sessticket_key;
267#endif
059ec3d9 268
17c76198 269/* ------------------------------------------------------------------------ */
17c76198 270/* macros */
83da1223 271
17c76198 272#define MAX_HOST_LEN 255
83da1223 273
17c76198
PP
274/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
275the library logging; a value less than 0 disables the calls to set up logging
dc6d1769
JH
276callbacks. GNuTLS also looks for an environment variable - except not for
277setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
278Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
279but the env var must be added to /etc/sudoers too. */
2c17bb02 280#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
b1a4f234 281# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 282#endif
83da1223 283
2c17bb02 284#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 285# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 286#endif
83da1223 287
af3498d6
PP
288/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
289can ask for a bit-strength. Without that, we stick to the constant we had
290before, for now. */
2c17bb02 291#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 292# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 293#endif
af3498d6 294
cf0c6164
JH
295#define expand_check_tlsvar(Varname, errstr) \
296 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 297
17c76198 298#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
299# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
300# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
301# define HAVE_GNUTLS_RND
2519e60d
TL
302/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
303 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
304 * isn't available sometimes, so this needs to become a conditional
305 * compilation; the sanest way to deal with this being a problem on
306 * older OSes is to block it in the Local/Makefile with this compiler
307 * definition */
e51c7be2
JH
308# ifndef AVOID_GNUTLS_PKCS11
309# define HAVE_GNUTLS_PKCS11
310# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 311#endif
83da1223 312
af3498d6
PP
313
314
315
316/* ------------------------------------------------------------------------ */
317/* Callback declarations */
318
319#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
320static void exim_gnutls_logger_cb(int level, const char *message);
321#endif
322
323static int exim_sni_handling_cb(gnutls_session_t session);
324
e5489333
JH
325#ifdef EXPERIMENTAL_TLS_RESUME
326static int
327tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
328 unsigned incoming, const gnutls_datum_t * msg);
329#endif
af3498d6
PP
330
331
b10c87b3
JH
332/* Daemon one-time initialisation */
333void
334tls_daemon_init(void)
335{
336#ifdef EXPERIMENTAL_TLS_RESUME
337/* We are dependent on the GnuTLS implementation of the Session Ticket
338encryption; both the strength and the key rotation period. We hope that
339the strength at least matches that of the ciphersuite (but GnuTLS does not
340document this). */
341
342static BOOL once = FALSE;
343if (once) return;
344once = TRUE;
345gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
346if (f.running_in_test_harness) ssl_session_timeout = 6;
347#endif
348}
349
17c76198
PP
350/* ------------------------------------------------------------------------ */
351/* Static functions */
059ec3d9
PH
352
353/*************************************************
354* Handle TLS error *
355*************************************************/
356
357/* Called from lots of places when errors occur before actually starting to do
358the TLS handshake, that is, while the session is still in clear. Always returns
359DEFER for a server and FAIL for a client so that most calls can use "return
360tls_error(...)" to do this processing and then give an appropriate return. A
361single function is used for both server and client, because it is called from
362some shared functions.
363
364Argument:
365 prefix text to include in the logged error
7199e1ee
TF
366 msg additional error string (may be NULL)
367 usually obtained from gnutls_strerror()
17c76198
PP
368 host NULL if setting up a server;
369 the connected host if setting up a client
cf0c6164 370 errstr pointer to returned error string
059ec3d9
PH
371
372Returns: OK/DEFER/FAIL
373*/
374
375static int
48224640 376tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 377 uschar ** errstr)
059ec3d9 378{
cf0c6164 379if (errstr)
48224640 380 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 381return host ? FAIL : DEFER;
059ec3d9
PH
382}
383
384
452a164f
JH
385static int
386tls_error_gnu(const uschar *prefix, int err, const host_item *host,
387 uschar ** errstr)
388{
389return tls_error(prefix, US gnutls_strerror(err), host, errstr);
390}
391
392static int
393tls_error_sys(const uschar *prefix, int err, const host_item *host,
394 uschar ** errstr)
395{
396return tls_error(prefix, US strerror(err), host, errstr);
397}
059ec3d9 398
17c76198 399
059ec3d9 400/*************************************************
17c76198 401* Deal with logging errors during I/O *
059ec3d9
PH
402*************************************************/
403
17c76198 404/* We have to get the identity of the peer from saved data.
059ec3d9 405
17c76198
PP
406Argument:
407 state the current GnuTLS exim state container
408 rc the GnuTLS error code, or 0 if it's a local error
409 when text identifying read or write
95f52235 410 text local error text when rc is 0
059ec3d9 411
17c76198 412Returns: nothing
059ec3d9
PH
413*/
414
17c76198
PP
415static void
416record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 417{
48224640 418const uschar * msg;
cf0c6164 419uschar * errstr;
059ec3d9 420
17c76198 421if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
95f52235 422 msg = string_sprintf("A TLS fatal alert has been received: %s",
17c76198
PP
423 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
424else
48224640 425 msg = US gnutls_strerror(rc);
059ec3d9 426
cf0c6164
JH
427(void) tls_error(when, msg, state->host, &errstr);
428
429if (state->host)
430 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
431 state->host->name, state->host->address, errstr);
432else
433 {
434 uschar * conn_info = smtp_get_connection_info();
435 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
436 /* I'd like to get separated H= here, but too hard for now */
437 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
438 }
17c76198 439}
059ec3d9 440
059ec3d9 441
059ec3d9 442
059ec3d9 443
17c76198
PP
444/*************************************************
445* Set various Exim expansion vars *
446*************************************************/
059ec3d9 447
e51c7be2
JH
448#define exim_gnutls_cert_err(Label) \
449 do \
450 { \
451 if (rc != GNUTLS_E_SUCCESS) \
452 { \
453 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
454 (Label), gnutls_strerror(rc)); \
455 return rc; \
456 } \
457 } while (0)
9d1c15ef
JH
458
459static int
27f19eb4 460import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
461{
462int rc;
463
464rc = gnutls_x509_crt_init(crtp);
465exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
466
467rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
468exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
469
470return rc;
471}
472
473#undef exim_gnutls_cert_err
474
475
17c76198
PP
476/* We set various Exim global variables from the state, once a session has
477been established. With TLS callouts, may need to change this to stack
478variables, or just re-call it with the server state after client callout
479has finished.
059ec3d9 480
9d1c15ef 481Make sure anything set here is unset in tls_getc().
17c76198
PP
482
483Sets:
484 tls_active fd
485 tls_bits strength indicator
486 tls_certificate_verified bool indicator
b1a32a3c 487 tls_channelbinding for some SASL mechanisms
da40b1ec 488 tls_ver a string
17c76198 489 tls_cipher a string
9d1c15ef 490 tls_peercert pointer to library internal
17c76198
PP
491 tls_peerdn a string
492 tls_sni a (UTF-8) string
9d1c15ef 493 tls_ourcert pointer to library internal
17c76198
PP
494
495Argument:
496 state the relevant exim_gnutls_state_st *
497*/
498
499static void
9d1c15ef 500extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 501{
17c76198
PP
502#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
503int old_pool;
504int rc;
505gnutls_datum_t channel;
506#endif
9d1c15ef 507tls_support * tlsp = state->tlsp;
17c76198 508
74f1a423
JH
509tlsp->active.sock = state->fd_out;
510tlsp->active.tls_ctx = state;
17c76198 511
817d9f57 512DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 513
9d1c15ef 514tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
515#ifdef SUPPORT_DANE
516tlsp->dane_verified = state->peer_dane_verified;
517#endif
059ec3d9 518
b1a32a3c 519/* note that tls_channelbinding is not saved to the spool file, since it's
17c76198
PP
520only available for use for authenticators while this TLS session is running. */
521
b1a32a3c 522tlsp->channelbinding = NULL;
17c76198
PP
523#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
524channel.data = NULL;
525channel.size = 0;
1f20760b
JH
526if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
527 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
528else
529 {
b1a32a3c
JH
530 /* Declare the taintedness of the binding info. On server, untainted; on
531 client, tainted - being the Finish msg from the server. */
532
17c76198
PP
533 old_pool = store_pool;
534 store_pool = POOL_PERM;
b1a32a3c
JH
535 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
536 !!state->host);
17c76198 537 store_pool = old_pool;
b1a32a3c 538 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
1f20760b 539 }
17c76198
PP
540#endif
541
9d1c15ef
JH
542/* peercert is set in peer_status() */
543tlsp->peerdn = state->peerdn;
544tlsp->sni = state->received_sni;
545
546/* record our certificate */
547 {
27f19eb4 548 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
549 gnutls_x509_crt_t crt;
550
551 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
552 }
059ec3d9
PH
553}
554
555
556
17c76198 557
49132a3b 558#ifndef GNUTLS_AUTO_DHPARAMS
059ec3d9 559/*************************************************
575643cd 560* Setup up DH parameters *
059ec3d9
PH
561*************************************************/
562
575643cd 563/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
564be re-generated every so often, depending on security policy. What we do is to
565keep these parameters in a file in the spool directory. If the file does not
566exist, we generate them. This means that it is easy to cause a regeneration.
567
568The new file is written as a temporary file and renamed, so that an incomplete
569file is never present. If two processes both compute some new parameters, you
570waste a bit of effort, but it doesn't seem worth messing around with locking to
571prevent this.
572
059ec3d9
PH
573Returns: OK/DEFER/FAIL
574*/
575
576static int
cf0c6164 577init_server_dh(uschar ** errstr)
059ec3d9 578{
17c76198
PP
579int fd, rc;
580unsigned int dh_bits;
49132a3b 581gnutls_datum_t m = {.data = NULL, .size = 0};
a799883d
PP
582uschar filename_buf[PATH_MAX];
583uschar *filename = NULL;
17c76198 584size_t sz;
a799883d
PP
585uschar *exp_tls_dhparam;
586BOOL use_file_in_spool = FALSE;
17c76198 587host_item *host = NULL; /* dummy for macros */
059ec3d9 588
17c76198 589DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 590
452a164f
JH
591if ((rc = gnutls_dh_params_init(&dh_server_params)))
592 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
059ec3d9 593
cf0c6164 594if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
595 return DEFER;
596
597if (!exp_tls_dhparam)
598 {
599 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
600 m.data = US std_dh_prime_default();
601 m.size = Ustrlen(m.data);
602 }
603else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
604 use_file_in_spool = TRUE;
605else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
606 {
607 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
608 return OK;
609 }
610else if (exp_tls_dhparam[0] != '/')
611 {
f5d25c2b 612 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 613 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
614 m.size = Ustrlen(m.data);
615 }
616else
a799883d 617 filename = exp_tls_dhparam;
a799883d
PP
618
619if (m.data)
620 {
452a164f
JH
621 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
622 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
a799883d
PP
623 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
624 return OK;
625 }
626
af3498d6
PP
627#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
628/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198 629different filename and ensure we have sufficient bits. */
452a164f
JH
630
631if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
cf0c6164 632 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 633DEBUG(D_tls)
b34fc30c 634 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
635 dh_bits);
636#else
637dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
638DEBUG(D_tls)
639 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
640 dh_bits);
641#endif
059ec3d9 642
3375e053
PP
643/* Some clients have hard-coded limits. */
644if (dh_bits > tls_dh_max_bits)
645 {
646 DEBUG(D_tls)
647 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
648 tls_dh_max_bits);
649 dh_bits = tls_dh_max_bits;
650 }
651
a799883d
PP
652if (use_file_in_spool)
653 {
654 if (!string_format(filename_buf, sizeof(filename_buf),
655 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 656 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
657 filename = filename_buf;
658 }
059ec3d9 659
b5aea5e1 660/* Open the cache file for reading and if successful, read it and set up the
575643cd 661parameters. */
059ec3d9 662
f5d25c2b 663if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 664 {
b5aea5e1 665 struct stat statbuf;
17c76198
PP
666 FILE *fp;
667 int saved_errno;
668
669 if (fstat(fd, &statbuf) < 0) /* EIO */
670 {
671 saved_errno = errno;
672 (void)close(fd);
452a164f 673 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
17c76198
PP
674 }
675 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
676 {
677 (void)close(fd);
cf0c6164 678 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 679 }
40c90bca 680 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
681 {
682 saved_errno = errno;
683 (void)close(fd);
452a164f
JH
684 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
685 saved_errno, NULL, errstr);
b5aea5e1 686 }
059ec3d9 687
b5aea5e1 688 m.size = statbuf.st_size;
f3ebb786 689 if (!(m.data = store_malloc(m.size)))
17c76198
PP
690 {
691 fclose(fp);
452a164f 692 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
17c76198 693 }
40c90bca 694 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
695 {
696 saved_errno = errno;
697 fclose(fp);
f3ebb786 698 store_free(m.data);
452a164f 699 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
17c76198
PP
700 }
701 fclose(fp);
b5aea5e1 702
17c76198 703 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
f3ebb786 704 store_free(m.data);
452a164f
JH
705 if (rc)
706 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
17c76198 707 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
708 }
709
710/* If the file does not exist, fall through to compute new data and cache it.
711If there was any other opening error, it is serious. */
712
182ad5cf
PH
713else if (errno == ENOENT)
714 {
17c76198 715 rc = -1;
182ad5cf 716 DEBUG(D_tls)
17c76198 717 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
718 }
719else
17c76198 720 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 721 NULL, NULL, errstr);
b5aea5e1
PH
722
723/* If ret < 0, either the cache file does not exist, or the data it contains
724is not useful. One particular case of this is when upgrading from an older
725release of Exim in which the data was stored in a different format. We don't
726try to be clever and support both formats; we just regenerate new data in this
727case. */
728
17c76198 729if (rc < 0)
b5aea5e1 730 {
17c76198 731 uschar *temp_fn;
201f5254 732 unsigned int dh_bits_gen = dh_bits;
059ec3d9 733
17c76198
PP
734 if ((PATH_MAX - Ustrlen(filename)) < 10)
735 return tls_error(US"Filename too long to generate replacement",
48224640 736 filename, NULL, errstr);
059ec3d9 737
48224640 738 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 739 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
452a164f 740 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
b66fecb4 741 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
059ec3d9 742
49132a3b
JH
743 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
744 there's no way to ask GnuTLS how many bits there really are. We can ask
745 how many bits were used in a TLS session, but that's it! The prime itself
746 is hidden behind too much abstraction. So we ask for less, and proceed on
747 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
748
cae6e576 749 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
750 {
751 dh_bits_gen = dh_bits - 10;
752 DEBUG(D_tls)
753 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
754 dh_bits_gen);
755 }
756
757 DEBUG(D_tls)
758 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
759 dh_bits_gen);
452a164f
JH
760 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
761 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
17c76198
PP
762
763 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
764 and I confirmed that a NULL call to get the size first is how the GnuTLS
765 sample apps handle this. */
766
767 sz = 0;
768 m.data = NULL;
452a164f
JH
769 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
770 GNUTLS_X509_FMT_PEM, m.data, &sz))
771 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
772 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
773 rc, host, errstr);
17c76198 774 m.size = sz;
f3ebb786 775 if (!(m.data = store_malloc(m.size)))
452a164f 776 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
40c90bca 777
1f00591e 778 /* this will return a size 1 less than the allocation size above */
452a164f
JH
779 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
780 m.data, &sz)))
17c76198 781 {
f3ebb786 782 store_free(m.data);
452a164f 783 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
17c76198 784 }
1f00591e 785 m.size = sz; /* shrink by 1, probably */
059ec3d9 786
f5d25c2b 787 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198 788 {
f3ebb786 789 store_free(m.data);
452a164f
JH
790 return tls_error_sys(US"TLS cache write D-H params failed",
791 errno, NULL, errstr);
17c76198 792 }
f3ebb786 793 store_free(m.data);
f5d25c2b 794 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
452a164f
JH
795 return tls_error_sys(US"TLS cache write D-H params final newline failed",
796 errno, NULL, errstr);
17c76198 797
f5d25c2b 798 if ((rc = close(fd)))
452a164f 799 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
059ec3d9 800
17c76198 801 if (Urename(temp_fn, filename) < 0)
452a164f
JH
802 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
803 temp_fn, filename), errno, NULL, errstr);
059ec3d9 804
17c76198 805 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
806 }
807
17c76198 808DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
809return OK;
810}
49132a3b 811#endif
059ec3d9
PH
812
813
814
815
23bb6982
JH
816/* Create and install a selfsigned certificate, for use in server mode */
817
818static int
cf0c6164 819tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
820{
821gnutls_x509_crt_t cert = NULL;
822time_t now;
823gnutls_x509_privkey_t pkey = NULL;
824const uschar * where;
825int rc;
826
827where = US"initialising pkey";
828if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
829
830where = US"initialising cert";
831if ((rc = gnutls_x509_crt_init(&cert))) goto err;
832
833where = US"generating pkey";
834if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 835#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
836# ifndef GNUTLS_SEC_PARAM_MEDIUM
837# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
838# endif
6aac3239 839 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 840#else
6aac3239 841 2048,
76075bb5
JH
842#endif
843 0)))
23bb6982
JH
844 goto err;
845
846where = US"configuring cert";
1613fd68 847now = 1;
23bb6982
JH
848if ( (rc = gnutls_x509_crt_set_version(cert, 3))
849 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
850 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
851 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
852 || (rc = gnutls_x509_crt_set_key(cert, pkey))
853
854 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
855 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
856 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
857 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
858 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
859 GNUTLS_OID_X520_COMMON_NAME, 0,
860 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
861 )
862 goto err;
863
864where = US"signing cert";
865if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
866
867where = US"installing selfsign cert";
868 /* Since: 2.4.0 */
869if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
870 goto err;
871
872rc = OK;
873
874out:
875 if (cert) gnutls_x509_crt_deinit(cert);
876 if (pkey) gnutls_x509_privkey_deinit(pkey);
877 return rc;
878
879err:
452a164f 880 rc = tls_error_gnu(where, rc, NULL, errstr);
23bb6982
JH
881 goto out;
882}
883
884
885
886
47195144
JH
887/* Add certificate and key, from files.
888
889Return:
890 Zero or negative: good. Negate value for certificate index if < 0.
891 Greater than zero: FAIL or DEFER code.
892*/
893
ba86e143
JH
894static int
895tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
896 uschar * certfile, uschar * keyfile, uschar ** errstr)
897{
898int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
899 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144 900if (rc < 0)
452a164f 901 return tls_error_gnu(
47195144 902 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
452a164f 903 rc, host, errstr);
47195144 904return -rc;
ba86e143
JH
905}
906
907
d896cef5
JH
908#if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
909/* Load an OCSP proof from file for sending by the server. Called
910on getting a status-request handshake message, for earlier versions
911of GnuTLS. */
912
913static int
914server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
915 gnutls_datum_t * ocsp_response)
916{
917int ret;
918DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
919
920if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
921 {
922 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
923 CS ptr);
924 tls_in.ocsp = OCSP_NOT_RESP;
925 return GNUTLS_E_NO_CERTIFICATE_STATUS;
926 }
927
928tls_in.ocsp = OCSP_VFY_NOT_TRIED;
929return 0;
930}
931#endif
932
933
be427508 934#ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
e5489333
JH
935/* Make a note that we saw a status-request */
936static int
937tls_server_clienthello_ext(void * ctx, unsigned tls_id,
938 const unsigned char *data, unsigned size)
939{
940/* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
941if (tls_id == 5) /* status_request */
942 {
e326959e 943 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
e5489333
JH
944 tls_in.ocsp = OCSP_NOT_RESP;
945 }
946return 0;
947}
948
949/* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
950static int
951tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
952 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
953{
954/* Call fn for each extension seen. 3.6.3 onwards */
955return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
956 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
957}
e326959e
JH
958
959
960/* Make a note that we saw a status-response */
961static int
962tls_server_servercerts_ext(void * ctx, unsigned tls_id,
963 const unsigned char *data, unsigned size)
964{
965/* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
966/* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
967if (FALSE && tls_id == 5) /* status_request */
968 {
969 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
970 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
971 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
972 }
973return 0;
974}
975
976/* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
977static int
978tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
979 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
980{
981/* Call fn for each extension seen. 3.6.3 onwards */
982#ifdef notdef
983/*XXX crashes */
984return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
985#endif
986}
be427508 987#endif
e5489333 988
e326959e
JH
989/*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
990 "Handshake Protocol: Certificate" record.
991So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
992
993This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
994*/
995
727a5d25 996#if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
e5489333
JH
997/* Callback for certificate-status, on server. We sent stapled OCSP. */
998static int
999tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1000 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1001{
e326959e 1002DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
e5489333
JH
1003#ifdef SUPPORT_SRV_OCSP_STACK
1004tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1005 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1006#else
1007tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1008#endif
1009return 0;
1010}
1011
1012/* Callback for handshake messages, on server */
1013static int
1014tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1015 unsigned incoming, const gnutls_datum_t * msg)
1016{
e326959e 1017/* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
e5489333
JH
1018switch (htype)
1019 {
727a5d25 1020# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
e5489333
JH
1021 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1022 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
e326959e
JH
1023 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1024 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
727a5d25 1025# endif
e5489333
JH
1026 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1027 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
727a5d25 1028# ifdef EXPERIMENTAL_TLS_RESUME
e5489333
JH
1029 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1030 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
727a5d25 1031# endif
e5489333
JH
1032 default:
1033 return 0;
1034 }
1035}
727a5d25 1036#endif
e5489333
JH
1037
1038
727a5d25 1039#if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
e5489333
JH
1040static void
1041tls_server_testharness_ocsp_fiddle(void)
1042{
1043extern char ** environ;
1044if (environ) for (uschar ** p = USS environ; *p; p++)
1045 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1046 {
1047 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1048 exim_testharness_disable_ocsp_validity_check = TRUE;
1049 }
1050}
727a5d25 1051#endif
e5489333 1052
059ec3d9 1053/*************************************************
17c76198 1054* Variables re-expanded post-SNI *
059ec3d9
PH
1055*************************************************/
1056
17c76198
PP
1057/* Called from both server and client code, via tls_init(), and also from
1058the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1059
1060We can tell the two apart by state->received_sni being non-NULL in callback.
1061
1062The callback should not call us unless state->trigger_sni_changes is true,
1063which we are responsible for setting on the first pass through.
059ec3d9
PH
1064
1065Arguments:
17c76198 1066 state exim_gnutls_state_st *
cf0c6164 1067 errstr error string pointer
059ec3d9
PH
1068
1069Returns: OK/DEFER/FAIL
1070*/
1071
1072static int
ba86e143 1073tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 1074{
1365611d 1075struct stat statbuf;
059ec3d9 1076int rc;
17c76198
PP
1077const host_item *host = state->host; /* macro should be reconsidered? */
1078uschar *saved_tls_certificate = NULL;
1079uschar *saved_tls_privatekey = NULL;
1080uschar *saved_tls_verify_certificates = NULL;
1081uschar *saved_tls_crl = NULL;
1082int cert_count;
1083
1084/* We check for tls_sni *before* expansion. */
2b4a568d 1085if (!host) /* server */
17c76198
PP
1086 if (!state->received_sni)
1087 {
ba86e143
JH
1088 if ( state->tls_certificate
1089 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1090 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1091 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1092 ) )
17c76198
PP
1093 {
1094 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1095 state->trigger_sni_changes = TRUE;
1096 }
1097 }
1098 else
1099 {
1365611d 1100 /* useful for debugging */
17c76198
PP
1101 saved_tls_certificate = state->exp_tls_certificate;
1102 saved_tls_privatekey = state->exp_tls_privatekey;
1103 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1104 saved_tls_crl = state->exp_tls_crl;
1105 }
059ec3d9 1106
452a164f
JH
1107if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1108 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1109 rc, host, errstr);
47195144
JH
1110
1111#ifdef SUPPORT_SRV_OCSP_STACK
1112gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
e326959e
JH
1113
1114# if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1115if (!host && tls_ocsp_file)
1116 {
1117 if (f.running_in_test_harness)
1118 tls_server_testharness_ocsp_fiddle();
1119
1120 if (exim_testharness_disable_ocsp_validity_check)
1121 gnutls_certificate_set_flags(state->x509_cred,
1122 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1123 }
1124# endif
47195144 1125#endif
1365611d 1126
17c76198
PP
1127/* remember: expand_check_tlsvar() is expand_check() but fiddling with
1128state members, assuming consistent naming; and expand_check() returns
1129false if expansion failed, unless expansion was forced to fail. */
059ec3d9 1130
17c76198
PP
1131/* check if we at least have a certificate, before doing expensive
1132D-H generation. */
059ec3d9 1133
cf0c6164 1134if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 1135 return DEFER;
059ec3d9 1136
17c76198 1137/* certificate is mandatory in server, optional in client */
059ec3d9 1138
23bb6982
JH
1139if ( !state->exp_tls_certificate
1140 || !*state->exp_tls_certificate
1141 )
2b4a568d 1142 if (!host)
cf0c6164 1143 return tls_install_selfsign(state, errstr);
17c76198
PP
1144 else
1145 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 1146
cf0c6164 1147if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
1148 return DEFER;
1149
17c76198
PP
1150/* tls_privatekey is optional, defaulting to same file as certificate */
1151
e326959e 1152if (!state->tls_privatekey || !*state->tls_privatekey)
059ec3d9 1153 {
17c76198
PP
1154 state->tls_privatekey = state->tls_certificate;
1155 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 1156 }
c91535f3 1157
059ec3d9 1158
17c76198 1159if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
1160 {
1161 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
1162 state->exp_tls_certificate, state->exp_tls_privatekey);
1163
1164 if (state->received_sni)
23bb6982
JH
1165 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1166 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1167 )
17c76198 1168 {
b34fc30c 1169 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
1170 }
1171 else
1172 {
b34fc30c 1173 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 1174 }
059ec3d9 1175
ba86e143
JH
1176 if (!host) /* server */
1177 {
1178 const uschar * clist = state->exp_tls_certificate;
1179 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
1180 const uschar * olist;
1181 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1182 uschar * cfile, * kfile, * ofile;
47195144 1183#ifndef DISABLE_OCSP
e326959e
JH
1184# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1185 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1186# endif
1187
47195144
JH
1188 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1189 return DEFER;
1190 olist = ofile;
1191#endif
ba86e143
JH
1192
1193 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 1194
ba86e143
JH
1195 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1196 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 1197 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
1198 return rc;
1199 else
47195144
JH
1200 {
1201 int gnutls_cert_index = -rc;
e326959e
JH
1202 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1203 gnutls_cert_index, cfile);
47195144
JH
1204
1205#ifndef DISABLE_OCSP
1206 if (tls_ocsp_file)
e5489333 1207 {
e326959e 1208 /* Set the OCSP stapling server info */
47195144
JH
1209 if (gnutls_buggy_ocsp)
1210 {
1211 DEBUG(D_tls)
1212 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1213 }
1214 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1215 {
e326959e
JH
1216 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1217 gnutls_cert_index, ofile);
be427508 1218# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
e326959e 1219 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
47195144 1220 {
e326959e
JH
1221 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1222 ofile += 4;
1223 }
1224 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1225 {
1226 ocsp_fmt = GNUTLS_X509_FMT_DER;
1227 ofile += 4;
1228 }
e5489333 1229
e326959e
JH
1230 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1231 state->x509_cred, CCS ofile, gnutls_cert_index,
1232 ocsp_fmt)) < 0)
1233 return tls_error_gnu(
1234 US"gnutls_certificate_set_ocsp_status_request_file2",
1235 rc, host, errstr);
1236 DEBUG(D_tls)
1237 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
e5489333 1238
e326959e
JH
1239 /* Arrange callbacks for OCSP request observability */
1240
1241 gnutls_handshake_set_hook_function(state->session,
1242 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1243
1244# else
1245# if defined(SUPPORT_SRV_OCSP_STACK)
be427508
JH
1246 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1247 state->x509_cred, gnutls_cert_index,
1248 server_ocsp_stapling_cb, ofile)))
1249 return tls_error_gnu(
1250 US"gnutls_certificate_set_ocsp_status_request_function2",
1251 rc, host, errstr);
1252 else
e326959e 1253# endif
e5489333
JH
1254 {
1255 if (cnt++ > 0)
1256 {
1257 DEBUG(D_tls)
1258 debug_printf("oops; multiple OCSP files not supported\n");
1259 break;
1260 }
d896cef5
JH
1261 gnutls_certificate_set_ocsp_status_request_function(
1262 state->x509_cred, server_ocsp_stapling_cb, ofile);
e5489333 1263 }
e326959e 1264# endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
47195144
JH
1265 }
1266 else
1267 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
e5489333 1268 }
fd71e7b8 1269#endif /* DISABLE_OCSP */
47195144 1270 }
ba86e143 1271 }
e5489333 1272 else /* client */
ba86e143 1273 {
47195144 1274 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1275 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1276 return rc;
1277 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1278 }
1279
b34fc30c 1280 } /* tls_certificate */
059ec3d9 1281
2b4a568d 1282
059ec3d9
PH
1283/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1284provided. Experiment shows that, if the certificate file is empty, an unhelpful
1285error message is provided. However, if we just refrain from setting anything up
1286in that case, certificate verification fails, which seems to be the correct
1287behaviour. */
1288
610ff438 1289if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1290 {
cf0c6164 1291 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1292 return DEFER;
610ff438
JH
1293#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1294 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1295 state->exp_tls_verify_certificates = NULL;
1296#endif
17c76198 1297 if (state->tls_crl && *state->tls_crl)
cf0c6164 1298 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1299 return DEFER;
059ec3d9 1300
1365611d
PP
1301 if (!(state->exp_tls_verify_certificates &&
1302 *state->exp_tls_verify_certificates))
b34fc30c
PP
1303 {
1304 DEBUG(D_tls)
1365611d
PP
1305 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1306 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1307 return OK;
b34fc30c 1308 }
1365611d 1309 }
83e2f8a2
PP
1310else
1311 {
1312 DEBUG(D_tls)
1313 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1314 return OK;
1315 }
17c76198 1316
cb1d7830
JH
1317#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1318if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1319 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1320else
1321#endif
1365611d 1322 {
cb1d7830
JH
1323 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1324 {
d896cef5 1325 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
cb1d7830
JH
1326 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1327 strerror(errno));
1328 return DEFER;
1329 }
17c76198 1330
a7fec7a7 1331#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1332 /* The test suite passes in /dev/null; we could check for that path explicitly,
1333 but who knows if someone has some weird FIFO which always dumps some certs, or
1334 other weirdness. The thing we really want to check is that it's not a
1335 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1336 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1337 if (S_ISDIR(statbuf.st_mode))
1338 {
1339 DEBUG(D_tls)
1340 debug_printf("verify certificates path is a dir: \"%s\"\n",
1341 state->exp_tls_verify_certificates);
1342 log_write(0, LOG_MAIN|LOG_PANIC,
1343 "tls_verify_certificates \"%s\" is a directory",
1344 state->exp_tls_verify_certificates);
1345 return DEFER;
1346 }
a7fec7a7 1347#endif
059ec3d9 1348
cb1d7830
JH
1349 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1350 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1351
cb1d7830
JH
1352 if (statbuf.st_size == 0)
1353 {
1354 DEBUG(D_tls)
1355 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1356 return OK;
1357 }
059ec3d9 1358
cb1d7830 1359 cert_count =
a7fec7a7
JH
1360
1361#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1362 (statbuf.st_mode & S_IFMT) == S_IFDIR
1363 ?
1364 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1365 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1366 :
a7fec7a7 1367#endif
cb1d7830
JH
1368 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1369 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
12d95aa6
JH
1370
1371#ifdef SUPPORT_CA_DIR
1372 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1373 when using the directory-of-certs config model. */
1374
1375 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1376 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1377#endif
cb1d7830 1378 }
a7fec7a7 1379
1365611d 1380if (cert_count < 0)
452a164f
JH
1381 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1382DEBUG(D_tls)
1383 debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1384
5c8cda3a
PP
1385if (state->tls_crl && *state->tls_crl &&
1386 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1387 {
5c8cda3a 1388 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
452a164f
JH
1389 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1390 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1391 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1392 cert_count, host, errstr);
1393
5c8cda3a 1394 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1395 }
059ec3d9 1396
059ec3d9
PH
1397return OK;
1398}
1399
1400
1401
1402
1403/*************************************************
1365611d
PP
1404* Set X.509 state variables *
1405*************************************************/
1406
1407/* In GnuTLS, the registered cert/key are not replaced by a later
1408set of a cert/key, so for SNI support we need a whole new x509_cred
1409structure. Which means various other non-re-expanded pieces of state
1410need to be re-set in the new struct, so the setting logic is pulled
1411out to this.
1412
1413Arguments:
1414 state exim_gnutls_state_st *
cf0c6164 1415 errstr error string pointer
1365611d
PP
1416
1417Returns: OK/DEFER/FAIL
1418*/
1419
1420static int
cf0c6164 1421tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1422{
1423int rc;
1424const host_item *host = state->host; /* macro should be reconsidered? */
1425
49132a3b 1426#ifndef GNUTLS_AUTO_DHPARAMS
1365611d
PP
1427/* Create D-H parameters, or read them from the cache file. This function does
1428its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1429client-side params. */
1430
1431if (!state->host)
1432 {
1433 if (!dh_server_params)
452a164f 1434 if ((rc = init_server_dh(errstr)) != OK) return rc;
49132a3b
JH
1435
1436 /* Unnecessary & discouraged with 3.6.0 or later */
1365611d
PP
1437 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1438 }
49132a3b 1439#endif
1365611d
PP
1440
1441/* Link the credentials to the session. */
1442
452a164f
JH
1443if ((rc = gnutls_credentials_set(state->session,
1444 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1445 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1365611d
PP
1446
1447return OK;
1448}
1449
1450/*************************************************
17c76198 1451* Initialize for GnuTLS *
059ec3d9
PH
1452*************************************************/
1453
9196d5bf 1454
4fb7df6d
JH
1455#ifndef DISABLE_OCSP
1456
9196d5bf
JH
1457static BOOL
1458tls_is_buggy_ocsp(void)
1459{
1460const uschar * s;
1461uschar maj, mid, mic;
1462
1463s = CUS gnutls_check_version(NULL);
1464maj = atoi(CCS s);
1465if (maj == 3)
1466 {
1467 while (*s && *s != '.') s++;
1468 mid = atoi(CCS ++s);
1469 if (mid <= 2)
1470 return TRUE;
1471 else if (mid >= 5)
1472 return FALSE;
1473 else
1474 {
1475 while (*s && *s != '.') s++;
1476 mic = atoi(CCS ++s);
1477 return mic <= (mid == 3 ? 16 : 3);
1478 }
1479 }
1480return FALSE;
1481}
1482
4fb7df6d 1483#endif
9196d5bf
JH
1484
1485
17c76198
PP
1486/* Called from both server and client code. In the case of a server, errors
1487before actual TLS negotiation return DEFER.
059ec3d9
PH
1488
1489Arguments:
17c76198
PP
1490 host connected host, if client; NULL if server
1491 certificate certificate file
1492 privatekey private key file
1493 sni TLS SNI to send, sometimes when client; else NULL
1494 cas CA certs file
1495 crl CRL file
1496 require_ciphers tls_require_ciphers setting
817d9f57 1497 caller_state returned state-info structure
cf0c6164 1498 errstr error string pointer
059ec3d9 1499
17c76198 1500Returns: OK/DEFER/FAIL
059ec3d9
PH
1501*/
1502
17c76198
PP
1503static int
1504tls_init(
1505 const host_item *host,
1506 const uschar *certificate,
1507 const uschar *privatekey,
1508 const uschar *sni,
1509 const uschar *cas,
1510 const uschar *crl,
1511 const uschar *require_ciphers,
cf0c6164 1512 exim_gnutls_state_st **caller_state,
74f1a423 1513 tls_support * tlsp,
cf0c6164 1514 uschar ** errstr)
059ec3d9 1515{
00c0dd4e 1516exim_gnutls_state_st * state;
17c76198
PP
1517int rc;
1518size_t sz;
00c0dd4e
JH
1519const char * errpos;
1520const uschar * p;
17c76198
PP
1521
1522if (!exim_gnutls_base_init_done)
059ec3d9 1523 {
17c76198
PP
1524 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1525
9f707b89 1526#if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
a5f239e4
PP
1527 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1528 which loads modules from a config file, which sounds good and may be wanted
1529 by some sysadmin, but also means in common configurations that GNOME keyring
1530 environment variables are used and so breaks for users calling mailq.
1531 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1532 if (!gnutls_allow_auto_pkcs11)
452a164f
JH
1533 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1534 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
a5f239e4
PP
1535#endif
1536
4d2a62a3 1537#ifndef GNUTLS_AUTO_GLOBAL_INIT
452a164f
JH
1538 if ((rc = gnutls_global_init()))
1539 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
4d2a62a3 1540#endif
17c76198
PP
1541
1542#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1543 DEBUG(D_tls)
059ec3d9 1544 {
17c76198 1545 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1546 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1547 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1548 }
17c76198
PP
1549#endif
1550
4fb7df6d
JH
1551#ifndef DISABLE_OCSP
1552 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1553 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1554#endif
9196d5bf 1555
17c76198 1556 exim_gnutls_base_init_done = TRUE;
059ec3d9 1557 }
059ec3d9 1558
17c76198
PP
1559if (host)
1560 {
74f1a423
JH
1561 /* For client-side sessions we allocate a context. This lets us run
1562 several in parallel. */
1563 int old_pool = store_pool;
1564 store_pool = POOL_PERM;
f3ebb786 1565 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
74f1a423
JH
1566 store_pool = old_pool;
1567
17c76198 1568 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1569 state->tlsp = tlsp;
17c76198
PP
1570 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1571 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1572 }
1573else
1574 {
1575 state = &state_server;
1576 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1577 state->tlsp = tlsp;
17c76198
PP
1578 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1579 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1580 }
452a164f
JH
1581if (rc)
1582 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
059ec3d9 1583
17c76198 1584state->host = host;
059ec3d9 1585
17c76198
PP
1586state->tls_certificate = certificate;
1587state->tls_privatekey = privatekey;
5779e6aa 1588state->tls_require_ciphers = require_ciphers;
17c76198
PP
1589state->tls_sni = sni;
1590state->tls_verify_certificates = cas;
1591state->tls_crl = crl;
059ec3d9 1592
17c76198
PP
1593/* This handles the variables that might get re-expanded after TLS SNI;
1594that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1595
17c76198
PP
1596DEBUG(D_tls)
1597 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1598if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1599
1365611d
PP
1600/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1601requires a new structure afterwards. */
83da1223 1602
cf0c6164 1603if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1604
17c76198
PP
1605/* set SNI in client, only */
1606if (host)
1607 {
cf0c6164 1608 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1609 return DEFER;
0df4ab80 1610 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1611 {
1612 DEBUG(D_tls)
0df4ab80
JH
1613 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1614 sz = Ustrlen(state->tlsp->sni);
452a164f
JH
1615 if ((rc = gnutls_server_name_set(state->session,
1616 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1617 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
17c76198
PP
1618 }
1619 }
1620else if (state->tls_sni)
1621 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1622 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1623
17c76198 1624/* This is the priority string support,
42bfef1e 1625http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1626and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1627This was backwards incompatible, but means Exim no longer needs to track
1628all algorithms and provide string forms for them. */
83da1223 1629
fc243e94 1630p = NULL;
17c76198 1631if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1632 {
cf0c6164 1633 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1634 return DEFER;
1635 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1636 {
17c76198 1637 p = state->exp_tls_require_ciphers;
fc243e94 1638 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
83da1223
PH
1639 }
1640 }
fc243e94 1641if (!p)
17c76198 1642 {
fc243e94 1643 p = exim_default_gnutls_priority;
83e2f8a2 1644 DEBUG(D_tls)
fc243e94 1645 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
17c76198 1646 }
83da1223 1647
452a164f
JH
1648if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1649 return tls_error_gnu(string_sprintf(
1650 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1651 p, errpos - CS p, errpos),
1652 rc, host, errstr);
17c76198 1653
452a164f
JH
1654if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1655 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
17c76198 1656
b10c87b3
JH
1657/* This also sets the server ticket expiration time to the same, and
1658the STEK rotation time to 3x. */
1659
17c76198
PP
1660gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1661
1662/* Reduce security in favour of increased compatibility, if the admin
1663decides to make that trade-off. */
1664if (gnutls_compat_mode)
83da1223 1665 {
17c76198
PP
1666#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1667 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1668 gnutls_session_enable_compatibility_mode(state->session);
1669#else
1670 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1671#endif
83da1223
PH
1672 }
1673
17c76198 1674*caller_state = state;
17c76198 1675return OK;
83da1223
PH
1676}
1677
1678
1679
83da1223 1680/*************************************************
17c76198 1681* Extract peer information *
059ec3d9
PH
1682*************************************************/
1683
f1be21cf
JH
1684static const uschar *
1685cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1686 gnutls_mac_algorithm_t mac)
1687{
1688uschar cs_id[2];
1689gnutls_kx_algorithm_t kx_i;
1690gnutls_cipher_algorithm_t cipher_i;
1691gnutls_mac_algorithm_t mac_i;
1692
1693for (size_t i = 0;
1694 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1695 i++)
1696 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1697 return cipher_stdname(cs_id[0], cs_id[1]);
1698return NULL;
1699}
1700
1701
1702
17c76198 1703/* Called from both server and client code.
4fe99a6c
PP
1704Only this is allowed to set state->peerdn and state->have_set_peerdn
1705and we use that to detect double-calls.
059ec3d9 1706
75fe387d
PP
1707NOTE: the state blocks last while the TLS connection is up, which is fine
1708for logging in the server side, but for the client side, we log after teardown
1709in src/deliver.c. While the session is up, we can twist about states and
1710repoint tls_* globals, but those variables used for logging or other variable
1711expansion that happens _after_ delivery need to have a longer life-time.
1712
1713So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1714doing this more than once per generation of a state context. We set them in
1715the state context, and repoint tls_* to them. After the state goes away, the
1716tls_* copies of the pointers remain valid and client delivery logging is happy.
1717
1718tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1719don't apply.
1720
059ec3d9 1721Arguments:
17c76198 1722 state exim_gnutls_state_st *
cf0c6164 1723 errstr pointer to error string
059ec3d9 1724
17c76198 1725Returns: OK/DEFER/FAIL
059ec3d9
PH
1726*/
1727
17c76198 1728static int
b10c87b3 1729peer_status(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 1730{
b10c87b3
JH
1731gnutls_session_t session = state->session;
1732const gnutls_datum_t * cert_list;
75fe387d 1733int old_pool, rc;
17c76198 1734unsigned int cert_list_size = 0;
4fe99a6c
PP
1735gnutls_protocol_t protocol;
1736gnutls_cipher_algorithm_t cipher;
1737gnutls_kx_algorithm_t kx;
1738gnutls_mac_algorithm_t mac;
17c76198
PP
1739gnutls_certificate_type_t ct;
1740gnutls_x509_crt_t crt;
b10c87b3 1741uschar * dn_buf;
17c76198 1742size_t sz;
059ec3d9 1743
4fe99a6c 1744if (state->have_set_peerdn)
17c76198 1745 return OK;
4fe99a6c 1746state->have_set_peerdn = TRUE;
059ec3d9 1747
4fe99a6c 1748state->peerdn = NULL;
059ec3d9 1749
4fe99a6c 1750/* tls_cipher */
b10c87b3
JH
1751cipher = gnutls_cipher_get(session);
1752protocol = gnutls_protocol_get_version(session);
1753mac = gnutls_mac_get(session);
b9c6f63c
JH
1754kx =
1755#ifdef GNUTLS_TLS1_3
1756 protocol >= GNUTLS_TLS1_3 ? 0 :
1757#endif
b10c87b3 1758 gnutls_kx_get(session);
4fe99a6c 1759
75fe387d 1760old_pool = store_pool;
f1be21cf 1761 {
b10c87b3 1762 tls_support * tlsp = state->tlsp;
f1be21cf 1763 store_pool = POOL_PERM;
d9acfc1c
JH
1764
1765#ifdef SUPPORT_GNUTLS_SESS_DESC
1766 {
1767 gstring * g = NULL;
b10c87b3 1768 uschar * s = US gnutls_session_get_desc(session), c;
d9acfc1c
JH
1769
1770 /* Nikos M suggests we use this by preference. It returns like:
1771 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1772
1773 For partial back-compat, put a colon after the TLS version, replace the
1774 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1775
1776 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1777
1778 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
da40b1ec
JH
1779
1780 tlsp->ver = string_copyn(g->s, g->ptr);
1781 for (uschar * p = US tlsp->ver; *p; p++)
1782 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
1783
d9acfc1c
JH
1784 g = string_catn(g, US":", 1);
1785 if (*s) s++; /* now on _ between groups */
1786 while ((c = *s))
1787 {
da40b1ec
JH
1788 for (*++s && ++s; (c = *s) && c != ')'; s++)
1789 g = string_catn(g, c == '-' ? US"_" : s, 1);
d9acfc1c
JH
1790 /* now on ) closing group */
1791 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1792 /* now on _ between groups */
1793 }
1794 g = string_catn(g, US":", 1);
1795 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1796 state->ciphersuite = string_from_gstring(g);
1797 }
1798#else
f1be21cf
JH
1799 state->ciphersuite = string_sprintf("%s:%s:%d",
1800 gnutls_protocol_get_name(protocol),
1801 gnutls_cipher_suite_get_name(kx, cipher, mac),
1802 (int) gnutls_cipher_get_key_size(cipher) * 8);
1803
1804 /* I don't see a way that spaces could occur, in the current GnuTLS
1805 code base, but it was a concern in the old code and perhaps older GnuTLS
1806 releases did return "TLS 1.0"; play it safe, just in case. */
1807
1808 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
da40b1ec
JH
1809 tlsp->ver = string_copyn(state->ciphersuite,
1810 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
d9acfc1c
JH
1811#endif
1812
1813/* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1814
b10c87b3
JH
1815 tlsp->cipher = state->ciphersuite;
1816 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
f1be21cf 1817
b10c87b3 1818 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
f1be21cf 1819 }
75fe387d 1820store_pool = old_pool;
4fe99a6c
PP
1821
1822/* tls_peerdn */
b10c87b3 1823cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
83da1223 1824
f1be21cf 1825if (!cert_list || cert_list_size == 0)
17c76198 1826 {
17c76198
PP
1827 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1828 cert_list, cert_list_size);
e51c7be2 1829 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1830 return tls_error(US"certificate verification failed",
48224640 1831 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1832 return OK;
1833 }
059ec3d9 1834
b10c87b3 1835if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
059ec3d9 1836 {
95f52235 1837 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1838 DEBUG(D_tls)
1839 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1840 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1841 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1842 ctn, state->host, errstr);
17c76198 1843 return OK;
83da1223 1844 }
059ec3d9 1845
e51c7be2
JH
1846#define exim_gnutls_peer_err(Label) \
1847 do { \
1848 if (rc != GNUTLS_E_SUCCESS) \
1849 { \
1850 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1851 (Label), gnutls_strerror(rc)); \
1852 if (state->verify_requirement >= VERIFY_REQUIRED) \
452a164f 1853 return tls_error_gnu((Label), rc, state->host, errstr); \
e51c7be2
JH
1854 return OK; \
1855 } \
1856 } while (0)
17c76198 1857
9d1c15ef
JH
1858rc = import_cert(&cert_list[0], &crt);
1859exim_gnutls_peer_err(US"cert 0");
1860
1861state->tlsp->peercert = state->peercert = crt;
17c76198 1862
17c76198
PP
1863sz = 0;
1864rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1865if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1866 {
17c76198
PP
1867 exim_gnutls_peer_err(US"getting size for cert DN failed");
1868 return FAIL; /* should not happen */
059ec3d9 1869 }
f3ebb786 1870dn_buf = store_get_perm(sz, TRUE); /* tainted */
17c76198
PP
1871rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1872exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1873
17c76198
PP
1874state->peerdn = dn_buf;
1875
1876return OK;
1877#undef exim_gnutls_peer_err
1878}
059ec3d9 1879
059ec3d9 1880
059ec3d9 1881
059ec3d9 1882
17c76198
PP
1883/*************************************************
1884* Verify peer certificate *
1885*************************************************/
059ec3d9 1886
17c76198
PP
1887/* Called from both server and client code.
1888*Should* be using a callback registered with
1889gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1890the peer information, but that's too new for some OSes.
059ec3d9 1891
17c76198 1892Arguments:
899b8bbc
JH
1893 state exim_gnutls_state_st *
1894 errstr where to put an error message
059ec3d9 1895
17c76198
PP
1896Returns:
1897 FALSE if the session should be rejected
1898 TRUE if the cert is okay or we just don't care
1899*/
059ec3d9 1900
17c76198 1901static BOOL
28646fa9 1902verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1903{
1904int rc;
899b8bbc
JH
1905uint verify;
1906
8008accd 1907DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1908*errstr = NULL;
b10c87b3 1909rc = peer_status(state, errstr);
17c76198 1910
b10c87b3
JH
1911if (state->verify_requirement == VERIFY_NONE)
1912 return TRUE;
1913
1914if (rc != OK || !state->peerdn)
e6060e2c 1915 {
17c76198 1916 verify = GNUTLS_CERT_INVALID;
cf0c6164 1917 *errstr = US"certificate not supplied";
17c76198
PP
1918 }
1919else
899b8bbc
JH
1920
1921 {
1922#ifdef SUPPORT_DANE
1923 if (state->verify_requirement == VERIFY_DANE && state->host)
1924 {
1925 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1926 including talking to a DNS resolver. But we want to do that bit ourselves
1927 as the testsuite intercepts and fakes its own DNS environment. */
1928
1929 dane_state_t s;
1930 dane_query_t r;
899b8bbc 1931 uint lsize;
94c13285
JH
1932 const gnutls_datum_t * certlist =
1933 gnutls_certificate_get_peers(state->session, &lsize);
1934 int usage = tls_out.tlsa_usage;
1935
1936# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1937 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1938 dane-verification separately so that we know which selector verified;
570cb1bd 1939 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1940
1941 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1942 { /* a mixed-usage bundle */
94c13285
JH
1943 int i, j, nrec;
1944 const char ** dd;
1945 int * ddl;
1946
3d2e82c5 1947 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
94c13285
JH
1948 nrec++;
1949
f3ebb786
JH
1950 dd = store_get(nrec * sizeof(uschar *), FALSE);
1951 ddl = store_get(nrec * sizeof(int), FALSE);
94c13285
JH
1952 nrec--;
1953
1954 if ((rc = dane_state_init(&s, 0)))
1955 goto tlsa_prob;
1956
1957 for (usage = DANESSL_USAGE_DANE_EE;
1958 usage >= DANESSL_USAGE_DANE_TA; usage--)
1959 { /* take records with this usage */
1960 for (j = i = 0; i < nrec; i++)
1961 if (state->dane_data[i][0] == usage)
1962 {
1963 dd[j] = state->dane_data[i];
1964 ddl[j++] = state->dane_data_len[i];
1965 }
1966 if (j)
1967 {
1968 dd[j] = NULL;
1969 ddl[j] = 0;
1970
1971 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1972 goto tlsa_prob;
1973
1974 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1975 gnutls_certificate_type_get(state->session),
1976 r, 0,
1977 usage == DANESSL_USAGE_DANE_EE
1978 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1979 &verify)))
1980 {
1981 DEBUG(D_tls)
1982 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1983 }
1984 else if (verify == 0) /* verification passed */
1985 {
1986 usage = 1 << usage;
1987 break;
1988 }
1989 }
1990 }
899b8bbc 1991
94c13285
JH
1992 if (rc) goto tlsa_prob;
1993 }
1994 else
1995# endif
899b8bbc 1996 {
94c13285
JH
1997 if ( (rc = dane_state_init(&s, 0))
1998 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1999 1, 0))
2000 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2001 gnutls_certificate_type_get(state->session),
5ec37a55 2002 r, 0,
94c13285
JH
2003# ifdef GNUTLS_BROKEN_DANE_VALIDATION
2004 usage == (1 << DANESSL_USAGE_DANE_EE)
2005 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2006# else
2007 0,
2008# endif
2009 &verify))
2010 )
2011 goto tlsa_prob;
899b8bbc 2012 }
94c13285
JH
2013
2014 if (verify != 0) /* verification failed */
899b8bbc
JH
2015 {
2016 gnutls_datum_t str;
2017 (void) dane_verification_status_print(verify, &str, 0);
2018 *errstr = US str.data; /* don't bother to free */
2019 goto badcert;
2020 }
28646fa9 2021
94c13285
JH
2022# ifdef GNUTLS_BROKEN_DANE_VALIDATION
2023 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 2024 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 2025
94c13285
JH
2026 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2027# endif
28646fa9 2028 {
570cb1bd 2029 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
2030 goto goodcert;
2031 }
570cb1bd
JH
2032# ifdef GNUTLS_BROKEN_DANE_VALIDATION
2033 /* Assume that the name on the A-record is the one that should be matching
2034 the cert. An alternate view is that the domain part of the email address
2035 is also permissible. */
2036
2037 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2038 CS state->host->name))
2039 {
2040 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2041 goto goodcert;
2042 }
2043# endif
899b8bbc 2044 }
570cb1bd 2045#endif /*SUPPORT_DANE*/
899b8bbc 2046
17c76198 2047 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 2048 }
e6060e2c 2049
899b8bbc 2050/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 2051
28646fa9 2052if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
2053 {
2054 state->peer_cert_verified = FALSE;
cf0c6164 2055 if (!*errstr)
184384c3
JH
2056 {
2057#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2058 DEBUG(D_tls)
2059 {
2060 gnutls_datum_t txt;
2061
2062 if (gnutls_certificate_verification_status_print(verify,
2063 gnutls_certificate_type_get(state->session), &txt, 0)
2064 == GNUTLS_E_SUCCESS)
2065 {
2066 debug_printf("%s\n", txt.data);
2067 gnutls_free(txt.data);
2068 }
2069 }
2070#endif
cf0c6164
JH
2071 *errstr = verify & GNUTLS_CERT_REVOKED
2072 ? US"certificate revoked" : US"certificate invalid";
184384c3 2073 }
059ec3d9 2074
17c76198 2075 DEBUG(D_tls)
e51c7be2 2076 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 2077 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 2078
e51c7be2 2079 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 2080 goto badcert;
17c76198 2081 DEBUG(D_tls)
4789da3a 2082 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 2083 }
e51c7be2 2084
17c76198
PP
2085else
2086 {
5fd28bb8
JH
2087 /* Client side, check the server's certificate name versus the name on the
2088 A-record for the connection we made. What to do for server side - what name
2089 to use for client? We document that there is no such checking for server
2090 side. */
2091
2092 if ( state->exp_tls_verify_cert_hostnames
2093 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2094 CS state->exp_tls_verify_cert_hostnames)
2095 )
e51c7be2 2096 {
5fd28bb8
JH
2097 DEBUG(D_tls)
2098 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2099 if (state->verify_requirement >= VERIFY_REQUIRED)
2100 goto badcert;
2101 return TRUE;
e51c7be2 2102 }
5fd28bb8 2103
17c76198 2104 state->peer_cert_verified = TRUE;
e51c7be2 2105 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 2106 state->peerdn ? state->peerdn : US"<unset>");
17c76198 2107 }
059ec3d9 2108
28646fa9
JH
2109goodcert:
2110 state->tlsp->peerdn = state->peerdn;
2111 return TRUE;
899b8bbc 2112
b83314e3 2113#ifdef SUPPORT_DANE
94c13285 2114tlsa_prob:
624f33df
JH
2115 *errstr = string_sprintf("TLSA record problem: %s",
2116 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
2117#endif
2118
899b8bbc
JH
2119badcert:
2120 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2121 return FALSE;
17c76198 2122}
059ec3d9 2123
17c76198
PP
2124
2125
2126
2127/* ------------------------------------------------------------------------ */
2128/* Callbacks */
2129
2130/* Logging function which can be registered with
2131 * gnutls_global_set_log_function()
2132 * gnutls_global_set_log_level() 0..9
2133 */
af3498d6 2134#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 2135static void
17c76198 2136exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 2137{
8c79eebf
PP
2138 size_t len = strlen(message);
2139 if (len < 1)
2140 {
2141 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2142 return;
2143 }
2144 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2145 message[len-1] == '\n' ? "" : "\n");
17c76198 2146}
af3498d6 2147#endif
059ec3d9 2148
059ec3d9 2149
17c76198
PP
2150/* Called after client hello, should handle SNI work.
2151This will always set tls_sni (state->received_sni) if available,
2152and may trigger presenting different certificates,
2153if state->trigger_sni_changes is TRUE.
059ec3d9 2154
17c76198
PP
2155Should be registered with
2156 gnutls_handshake_set_post_client_hello_function()
059ec3d9 2157
17c76198
PP
2158"This callback must return 0 on success or a gnutls error code to terminate the
2159handshake.".
059ec3d9 2160
17c76198
PP
2161For inability to get SNI information, we return 0.
2162We only return non-zero if re-setup failed.
817d9f57 2163Only used for server-side TLS.
17c76198 2164*/
44bbabb5 2165
17c76198
PP
2166static int
2167exim_sni_handling_cb(gnutls_session_t session)
2168{
2169char sni_name[MAX_HOST_LEN];
2170size_t data_len = MAX_HOST_LEN;
817d9f57 2171exim_gnutls_state_st *state = &state_server;
17c76198
PP
2172unsigned int sni_type;
2173int rc, old_pool;
cf0c6164 2174uschar * dummy_errstr;
17c76198
PP
2175
2176rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
2177if (rc != GNUTLS_E_SUCCESS)
2178 {
8775d84f 2179 DEBUG(D_tls)
b34fc30c
PP
2180 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2181 debug_printf("TLS: no SNI presented in handshake.\n");
2182 else
2183 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2184 gnutls_strerror(rc), rc);
b34fc30c
PP
2185 return 0;
2186 }
2187
17c76198
PP
2188if (sni_type != GNUTLS_NAME_DNS)
2189 {
2190 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2191 return 0;
2192 }
44bbabb5 2193
17c76198
PP
2194/* We now have a UTF-8 string in sni_name */
2195old_pool = store_pool;
2196store_pool = POOL_PERM;
89a80675 2197state->received_sni = string_copy_taint(US sni_name, TRUE);
17c76198
PP
2198store_pool = old_pool;
2199
2200/* We set this one now so that variable expansions below will work */
817d9f57 2201state->tlsp->sni = state->received_sni;
17c76198
PP
2202
2203DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2204 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2205
2206if (!state->trigger_sni_changes)
2207 return 0;
2208
cf0c6164 2209if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
2210 {
2211 /* If the setup of certs/etc failed before handshake, TLS would not have
2212 been offered. The best we can do now is abort. */
2213 return GNUTLS_E_APPLICATION_ERROR_MIN;
2214 }
2215
cf0c6164 2216rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
2217if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2218
2219return 0;
059ec3d9
PH
2220}
2221
2222
2223
0cbf2b82 2224#ifndef DISABLE_EVENT
a7538db1
JH
2225/*
2226We use this callback to get observability and detail-level control
723fe533
JH
2227for an exim TLS connection (either direction), raising a tls:cert event
2228for each cert in the chain presented by the peer. Any event
a7538db1
JH
2229can deny verification.
2230
2231Return 0 for the handshake to continue or non-zero to terminate.
2232*/
2233
2234static int
723fe533 2235verify_cb(gnutls_session_t session)
a7538db1 2236{
27f19eb4 2237const gnutls_datum_t * cert_list;
a7538db1
JH
2238unsigned int cert_list_size = 0;
2239gnutls_x509_crt_t crt;
2240int rc;
b30275b8 2241uschar * yield;
a7538db1
JH
2242exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2243
bd5b3f3c 2244if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
2245 while (cert_list_size--)
2246 {
bd5b3f3c 2247 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
2248 {
2249 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2250 cert_list_size, gnutls_strerror(rc));
2251 break;
2252 }
2253
2254 state->tlsp->peercert = crt;
b30275b8
JH
2255 if ((yield = event_raise(state->event_action,
2256 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
2257 {
2258 log_write(0, LOG_MAIN,
b30275b8
JH
2259 "SSL verify denied by event-action: depth=%d: %s",
2260 cert_list_size, yield);
a7538db1
JH
2261 return 1; /* reject */
2262 }
2263 state->tlsp->peercert = NULL;
2264 }
2265
2266return 0;
2267}
2268
2269#endif
44662487
JH
2270
2271
f20cfa4a
JH
2272static gstring *
2273ddump(gnutls_datum_t * d)
2274{
2275gstring * g = string_get((d->size+1) * 2);
2276uschar * s = d->data;
2277for (unsigned i = d->size; i > 0; i--, s++)
2278 {
2279 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2280 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2281 }
2282return g;
2283}
17c76198 2284
dc6d1769
JH
2285static void
2286post_handshake_debug(exim_gnutls_state_st * state)
2287{
dc6d1769
JH
2288#ifdef SUPPORT_GNUTLS_SESS_DESC
2289debug_printf("%s\n", gnutls_session_get_desc(state->session));
2290#endif
e326959e 2291
86ede124 2292#ifdef SUPPORT_GNUTLS_KEYLOG
e326959e 2293# ifdef EXIM_HAVE_TLS1_3
dc6d1769 2294if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
86ede124 2295# else
a8af957d 2296if (TRUE)
86ede124 2297# endif
dc6d1769
JH
2298 {
2299 gnutls_datum_t c, s;
2300 gstring * gc, * gs;
86ede124 2301 /* For TLS1.2 we only want the client random and the master secret */
dc6d1769
JH
2302 gnutls_session_get_random(state->session, &c, &s);
2303 gnutls_session_get_master_secret(state->session, &s);
2304 gc = ddump(&c);
2305 gs = ddump(&s);
2306 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2307 }
2308else
2309 debug_printf("To get keying info for TLS1.3 is hard:\n"
7832b9aa
HSHR
2310 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2311 " and make sure it is writable by the Exim runtime user.\n"
2312 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2313 " Start Exim as root.\n"
2314 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2315 " (works for TLS1.2 also, and saves cut-paste into file).\n"
86ede124 2316 " Trying to use add_environment for this will not work\n");
dc6d1769
JH
2317#endif
2318}
2319
b10c87b3
JH
2320
2321#ifdef EXPERIMENTAL_TLS_RESUME
2322static int
2323tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2324 unsigned incoming, const gnutls_datum_t * msg)
2325{
2326DEBUG(D_tls) debug_printf("newticket cb\n");
2327tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2328return 0;
2329}
2330
2331static void
2332tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2333{
2334/* Should the server offer session resumption? */
2335tls_in.resumption = RESUME_SUPPORTED;
2336if (verify_check_host(&tls_resumption_hosts) == OK)
2337 {
2338 int rc;
2339 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2340 an offered resumption is unacceptable. We lose one resumption per ticket
2341 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2342 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2343 least they go out in a single packet. */
2344
2345 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2346 &server_sessticket_key)))
2347 tls_in.resumption |= RESUME_SERVER_TICKET;
2348 else
2349 DEBUG(D_tls)
2350 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2351
2352 /* Try to tell if we see a ticket request */
2353 gnutls_handshake_set_hook_function(state->session,
e5489333 2354 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
b10c87b3
JH
2355 }
2356}
2357
2358static void
2359tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2360{
2361if (gnutls_session_resumption_requested(state->session))
2362 {
2363 /* This tells us the client sent a full ticket. We use a
2364 callback on session-ticket request, elsewhere, to tell
2365 if a client asked for a ticket. */
2366
2367 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2368 DEBUG(D_tls) debug_printf("client requested resumption\n");
2369 }
2370if (gnutls_session_is_resumed(state->session))
2371 {
2372 tls_in.resumption |= RESUME_USED;
2373 DEBUG(D_tls) debug_printf("Session resumed\n");
2374 }
2375}
2376#endif
17c76198
PP
2377/* ------------------------------------------------------------------------ */
2378/* Exported functions */
2379
2380
2381
2382
059ec3d9
PH
2383/*************************************************
2384* Start a TLS session in a server *
2385*************************************************/
2386
2387/* This is called when Exim is running as a server, after having received
2388the STARTTLS command. It must respond to that command, and then negotiate
2389a TLS session.
2390
2391Arguments:
83da1223 2392 require_ciphers list of allowed ciphers or NULL
cf0c6164 2393 errstr pointer to error string
059ec3d9
PH
2394
2395Returns: OK on success
2396 DEFER for errors before the start of the negotiation
4c04137d 2397 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2398 continue running.
2399*/
2400
2401int
cf0c6164 2402tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2403{
2404int rc;
cf0c6164 2405exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2406
2407/* Check for previous activation */
74f1a423 2408if (tls_in.active.sock >= 0)
059ec3d9 2409 {
48224640 2410 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2411 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2412 return FAIL;
2413 }
2414
2415/* Initialize the library. If it fails, it will already have logged the error
2416and sent an SMTP response. */
2417
17c76198 2418DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2419
d85cdeb5
JH
2420 {
2421#ifdef MEASURE_TIMING
2422 struct timeval t0;
2423 gettimeofday(&t0, NULL);
2424#endif
2425
2426 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2427 NULL, tls_verify_certificates, tls_crl,
2428 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2429
2430#ifdef MEASURE_TIMING
2431 report_time_since(&t0, US"server tls_init (delta)");
2432#endif
2433 }
059ec3d9 2434
b10c87b3
JH
2435#ifdef EXPERIMENTAL_TLS_RESUME
2436tls_server_resume_prehandshake(state);
2437#endif
2438
059ec3d9
PH
2439/* If this is a host for which certificate verification is mandatory or
2440optional, set up appropriately. */
2441
059ec3d9 2442if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2443 {
e51c7be2
JH
2444 DEBUG(D_tls)
2445 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2446 state->verify_requirement = VERIFY_REQUIRED;
2447 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2448 }
059ec3d9 2449else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2450 {
e51c7be2
JH
2451 DEBUG(D_tls)
2452 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2453 state->verify_requirement = VERIFY_OPTIONAL;
2454 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2455 }
2456else
2457 {
e51c7be2
JH
2458 DEBUG(D_tls)
2459 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2460 state->verify_requirement = VERIFY_NONE;
2461 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2462 }
059ec3d9 2463
0cbf2b82 2464#ifndef DISABLE_EVENT
723fe533
JH
2465if (event_action)
2466 {
2467 state->event_action = event_action;
2468 gnutls_session_set_ptr(state->session, state);
2469 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2470 }
2471#endif
2472
17c76198
PP
2473/* Register SNI handling; always, even if not in tls_certificate, so that the
2474expansion variable $tls_sni is always available. */
059ec3d9 2475
17c76198
PP
2476gnutls_handshake_set_post_client_hello_function(state->session,
2477 exim_sni_handling_cb);
059ec3d9
PH
2478
2479/* Set context and tell client to go ahead, except in the case of TLS startup
2480on connection, where outputting anything now upsets the clients and tends to
2481make them disconnect. We need to have an explicit fflush() here, to force out
2482the response. Other smtp_printf() calls do not need it, because in non-TLS
2483mode, the fflush() happens when smtp_getc() is called. */
2484
817d9f57 2485if (!state->tlsp->on_connect)
059ec3d9 2486 {
925ac8e4 2487 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2488 fflush(smtp_out);
059ec3d9
PH
2489 }
2490
2491/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2492that the GnuTLS library doesn't.
2493From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2494to set (and clear down afterwards) up a pull-timeout callback function that does
2495a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2496
17c76198 2497gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2498 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2499 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2500state->fd_in = fileno(smtp_in);
2501state->fd_out = fileno(smtp_out);
059ec3d9
PH
2502
2503sigalrm_seen = FALSE;
c2a1bba0 2504if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2505do
17c76198 2506 rc = gnutls_handshake(state->session);
157a7880 2507while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2508ALARM_CLR(0);
059ec3d9 2509
17c76198 2510if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2511 {
059ec3d9
PH
2512 /* It seems that, except in the case of a timeout, we have to close the
2513 connection right here; otherwise if the other end is running OpenSSL it hangs
2514 until the server times out. */
2515
60d10ce7 2516 if (sigalrm_seen)
ad7fc6eb 2517 {
48224640 2518 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2519 gnutls_db_remove_session(state->session);
2520 }
60d10ce7 2521 else
059ec3d9 2522 {
452a164f 2523 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
f5d25c2b 2524 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2525 gnutls_deinit(state->session);
ed62aae3 2526 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2527 millisleep(500);
ad7fc6eb 2528 shutdown(state->fd_out, SHUT_WR);
d7978c0f 2529 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
f1e894f3
PH
2530 (void)fclose(smtp_out);
2531 (void)fclose(smtp_in);
60d10ce7 2532 smtp_out = smtp_in = NULL;
059ec3d9
PH
2533 }
2534
2535 return FAIL;
2536 }
2537
17ba0f52 2538#ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
1c519e07
JH
2539if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2540 tls_in.ext_master_secret = TRUE;
17ba0f52 2541#endif
1c519e07 2542
b10c87b3
JH
2543#ifdef EXPERIMENTAL_TLS_RESUME
2544tls_server_resume_posthandshake(state);
2545#endif
2546
dc6d1769 2547DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2548
17c76198
PP
2549/* Verify after the fact */
2550
899b8bbc 2551if (!verify_certificate(state, errstr))
059ec3d9 2552 {
9d1c15ef 2553 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2554 {
cf0c6164 2555 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2556 return FAIL;
17c76198 2557 }
9d1c15ef
JH
2558 DEBUG(D_tls)
2559 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2560 *errstr);
059ec3d9
PH
2561 }
2562
17c76198
PP
2563/* Sets various Exim expansion variables; always safe within server */
2564
9d1c15ef 2565extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2566
2567/* TLS has been set up. Adjust the input functions to read via TLS,
2568and initialize appropriately. */
2569
17c76198 2570state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2571
2572receive_getc = tls_getc;
0d81dabc 2573receive_getbuf = tls_getbuf;
584e96c6 2574receive_get_cache = tls_get_cache;
059ec3d9
PH
2575receive_ungetc = tls_ungetc;
2576receive_feof = tls_feof;
2577receive_ferror = tls_ferror;
58eb016e 2578receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2579
059ec3d9
PH
2580return OK;
2581}
2582
2583
2584
2585
aa2a70ba
JH
2586static void
2587tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2588 smtp_transport_options_block * ob)
2589{
3fb3231c 2590if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2591 {
4af0d74a 2592 state->exp_tls_verify_cert_hostnames =
8c5d388a 2593#ifdef SUPPORT_I18N
4af0d74a
JH
2594 string_domain_utf8_to_alabel(host->name, NULL);
2595#else
2596 host->name;
2597#endif
aa2a70ba
JH
2598 DEBUG(D_tls)
2599 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2600 state->exp_tls_verify_cert_hostnames);
2601 }
2602}
aa2a70ba
JH
2603
2604
899b8bbc
JH
2605
2606
2607#ifdef SUPPORT_DANE
2608/* Given our list of RRs from the TLSA lookup, build a lookup block in
2609GnuTLS-DANE's preferred format. Hang it on the state str for later
2610use in DANE verification.
2611
2612We point at the dnsa data not copy it, so it must remain valid until
2613after verification is done.*/
2614
3674140c 2615static BOOL
899b8bbc
JH
2616dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2617{
899b8bbc
JH
2618dns_scan dnss;
2619int i;
2620const char ** dane_data;
2621int * dane_data_len;
2622
d7978c0f
JH
2623i = 1;
2624for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc
JH
2625 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2626 ) if (rr->type == T_TLSA) i++;
2627
f3ebb786
JH
2628dane_data = store_get(i * sizeof(uschar *), FALSE);
2629dane_data_len = store_get(i * sizeof(int), FALSE);
899b8bbc 2630
d7978c0f
JH
2631i = 0;
2632for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc 2633 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2634 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2635 {
2636 const uschar * p = rr->data;
f3ebb786 2637/*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3674140c
JH
2638 uint8_t usage = p[0], sel = p[1], type = p[2];
2639
2640 DEBUG(D_tls)
2641 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2642
94c13285
JH
2643 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2644 || (sel != 0 && sel != 1)
2645 )
2646 continue;
3674140c
JH
2647 switch(type)
2648 {
2649 case 0: /* Full: cannot check at present */
2650 break;
2651 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2652 break;
2653 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2654 break;
2655 default: continue;
2656 }
899b8bbc
JH
2657
2658 tls_out.tlsa_usage |= 1<<usage;
48224640 2659 dane_data[i] = CS p;
899b8bbc
JH
2660 dane_data_len[i++] = rr->size;
2661 }
3674140c
JH
2662
2663if (!i) return FALSE;
2664
899b8bbc
JH
2665dane_data[i] = NULL;
2666dane_data_len[i] = 0;
2667
2668state->dane_data = (char * const *)dane_data;
2669state->dane_data_len = dane_data_len;
3674140c 2670return TRUE;
899b8bbc
JH
2671}
2672#endif
2673
2674
2675
b10c87b3
JH
2676#ifdef EXPERIMENTAL_TLS_RESUME
2677/* On the client, get any stashed session for the given IP from hints db
2678and apply it to the ssl-connection for attempted resumption. Although
2679there is a gnutls_session_ticket_enable_client() interface it is
2680documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2681by deafult". There seems to be no way to disable them, so even hosts not
2682enabled by the transport option will be sent a ticket request. We will
2683however avoid storing and retrieving session information. */
2684
2685static void
2686tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2687 host_item * host, smtp_transport_options_block * ob)
2688{
2689tlsp->resumption = RESUME_SUPPORTED;
2690if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2691 {
2692 dbdata_tls_session * dt;
2693 int len, rc;
2694 open_db dbblock, * dbm_file;
2695
2696 DEBUG(D_tls)
2697 debug_printf("check for resumable session for %s\n", host->address);
2698 tlsp->host_resumable = TRUE;
2699 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2700 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2701 {
dea4b568
JH
2702 /* Key for the db is the IP. We'd like to filter the retrieved session
2703 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2704
b10c87b3
JH
2705 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2706 if (!(rc = gnutls_session_set_data(session,
2707 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2708 {
2709 DEBUG(D_tls) debug_printf("good session\n");
2710 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2711 }
2712 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2713 US gnutls_strerror(rc));
2714 dbfn_close(dbm_file);
2715 }
2716 }
2717}
2718
2719
2720static void
2721tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2722{
2723/* TLS 1.2 - we get both the callback and the direct posthandshake call,
2724but this flag is not set until the second. TLS 1.3 it's the other way about.
2725Keep both calls as the session data cannot be extracted before handshake
2726completes. */
2727
2728if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2729 {
2730 gnutls_datum_t tkt;
2731 int rc;
2732
2733 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2734 tlsp->ticket_received = TRUE;
2735 tlsp->resumption |= RESUME_SERVER_TICKET;
2736
2737 if (tlsp->host_resumable)
2738 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2739 {
2740 open_db dbblock, * dbm_file;
2741 int dlen = sizeof(dbdata_tls_session) + tkt.size;
f3ebb786 2742 dbdata_tls_session * dt = store_get(dlen, TRUE);
b10c87b3
JH
2743
2744 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2745 memcpy(dt->session, tkt.data, tkt.size);
2746 gnutls_free(tkt.data);
2747
2748 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2749 {
2750 /* key for the db is the IP */
2751 dbfn_delete(dbm_file, host->address);
2752 dbfn_write(dbm_file, host->address, dt, dlen);
2753 dbfn_close(dbm_file);
2754
2755 DEBUG(D_tls)
2756 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2757 }
2758 }
2759 else DEBUG(D_tls)
2760 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2761 }
2762}
2763
2764
2765/* With a TLS1.3 session, the ticket(s) are not seen until
2766the first data read is attempted. And there's often two of them.
2767Pick them up with this callback. We are also called for 1.2
2768but we do nothing.
2769*/
2770static int
2771tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2772 unsigned incoming, const gnutls_datum_t * msg)
2773{
2774exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2775tls_support * tlsp = state->tlsp;
2776
2777DEBUG(D_tls) debug_printf("newticket cb\n");
2778
2779if (!tlsp->ticket_received)
2780 tls_save_session(tlsp, sess, state->host);
2781return 0;
2782}
2783
2784
2785static void
2786tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2787 tls_support * tlsp, host_item * host,
2788 smtp_transport_options_block * ob)
2789{
2790gnutls_session_set_ptr(state->session, state);
2791gnutls_handshake_set_hook_function(state->session,
2792 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2793
2794tls_retrieve_session(tlsp, state->session, host, ob);
2795}
2796
2797static void
2798tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2799 tls_support * tlsp, host_item * host)
2800{
2801if (gnutls_session_is_resumed(state->session))
2802 {
2803 DEBUG(D_tls) debug_printf("Session resumed\n");
2804 tlsp->resumption |= RESUME_USED;
2805 }
2806
2807tls_save_session(tlsp, state->session, host);
2808}
2809#endif /* EXPERIMENTAL_TLS_RESUME */
2810
2811
059ec3d9
PH
2812/*************************************************
2813* Start a TLS session in a client *
2814*************************************************/
2815
2816/* Called from the smtp transport after STARTTLS has been accepted.
2817
2818Arguments:
c05bdbd6
JH
2819 cctx connection context
2820 conn_args connection details
2821 cookie datum for randomness (not used)
2822 tlsp record details of channel configuration here; must be non-NULL
2823 errstr error string pointer
2824
2825Returns: TRUE for success with TLS session context set in smtp context,
2826 FALSE on error
059ec3d9
PH
2827*/
2828
c05bdbd6
JH
2829BOOL
2830tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2831 void * cookie ARG_UNUSED,
2832 tls_support * tlsp, uschar ** errstr)
059ec3d9 2833{
c05bdbd6
JH
2834host_item * host = conn_args->host; /* for msgs and option-tests */
2835transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2836smtp_transport_options_block * ob = tb
afdb5e9c
JH
2837 ? (smtp_transport_options_block *)tb->options_block
2838 : &smtp_transport_option_defaults;
059ec3d9 2839int rc;
899b8bbc 2840exim_gnutls_state_st * state = NULL;
c05bdbd6 2841uschar * cipher_list = NULL;
74f1a423 2842
f2de3a33 2843#ifndef DISABLE_OCSP
5130845b 2844BOOL require_ocsp =
3fb3231c 2845 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2846BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2847 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2848#endif
059ec3d9 2849
c05bdbd6 2850DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
059ec3d9 2851
5ec37a55 2852#ifdef SUPPORT_DANE
c05bdbd6
JH
2853/* If dane is flagged, have either request or require dane for this host, and
2854a TLSA record found. Therefore, dane verify required. Which implies cert must
2855be requested and supplied, dane verify must pass, and cert verify irrelevant
2856(incl. hostnames), and (caller handled) require_tls */
2857
2858if (conn_args->dane && ob->dane_require_tls_ciphers)
5ec37a55
PP
2859 {
2860 /* not using expand_check_tlsvar because not yet in state */
2861 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2862 &cipher_list, errstr))
c05bdbd6 2863 return FALSE;
cf260049
JH
2864 cipher_list = cipher_list && *cipher_list
2865 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2866 }
2867#endif
2868
2869if (!cipher_list)
2870 cipher_list = ob->tls_require_ciphers;
2871
d85cdeb5
JH
2872 {
2873#ifdef MEASURE_TIMING
2874 struct timeval t0;
2875 gettimeofday(&t0, NULL);
2876#endif
2877
2878 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2879 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2880 cipher_list, &state, tlsp, errstr) != OK)
2881 return FALSE;
2882
2883#ifdef MEASURE_TIMING
2884 report_time_since(&t0, US"client tls_init (delta)");
2885#endif
2886 }
059ec3d9 2887
54c90be1 2888 {
65867078
JH
2889 int dh_min_bits = ob->tls_dh_min_bits;
2890 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2891 {
2892 DEBUG(D_tls)
2893 debug_printf("WARNING: tls_dh_min_bits far too low,"
2894 " clamping %d up to %d\n",
2895 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2896 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2897 }
54c90be1 2898
65867078
JH
2899 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2900 " acceptable bits to %d\n",
2901 dh_min_bits);
2902 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2903 }
83da1223 2904
94431adb 2905/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2906set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2907the specified host patterns if one of them is defined */
2908
899b8bbc 2909#ifdef SUPPORT_DANE
c05bdbd6 2910if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
899b8bbc
JH
2911 {
2912 DEBUG(D_tls)
2913 debug_printf("TLS: server certificate DANE required.\n");
2914 state->verify_requirement = VERIFY_DANE;
2915 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2916 }
2917else
2918#endif
2919 if ( ( state->exp_tls_verify_certificates
2920 && !ob->tls_verify_hosts
2921 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2922 )
3fb3231c 2923 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2924 )
17c76198 2925 {
aa2a70ba 2926 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2927 DEBUG(D_tls)
2928 debug_printf("TLS: server certificate verification required.\n");
2929 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2930 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2931 }
3fb3231c 2932else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2933 {
aa2a70ba 2934 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2935 DEBUG(D_tls)
2936 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2937 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2938 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2939 }
2940else
2941 {
e51c7be2
JH
2942 DEBUG(D_tls)
2943 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2944 state->verify_requirement = VERIFY_NONE;
2945 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2946 }
059ec3d9 2947
f2de3a33
JH
2948#ifndef DISABLE_OCSP
2949 /* supported since GnuTLS 3.1.3 */
44662487 2950if (request_ocsp)
9d1c15ef
JH
2951 {
2952 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2953 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2954 NULL, 0, NULL)) != OK)
74f1a423 2955 {
452a164f 2956 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
c05bdbd6 2957 return FALSE;
74f1a423
JH
2958 }
2959 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2960 }
2b4a568d
JH
2961#endif
2962
b10c87b3
JH
2963#ifdef EXPERIMENTAL_TLS_RESUME
2964tls_client_resume_prehandshake(state, tlsp, host, ob);
2965#endif
2966
0cbf2b82 2967#ifndef DISABLE_EVENT
afdb5e9c 2968if (tb && tb->event_action)
a7538db1 2969 {
774ef2d7 2970 state->event_action = tb->event_action;
a7538db1 2971 gnutls_session_set_ptr(state->session, state);
723fe533 2972 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2973 }
2974#endif
2975
c05bdbd6
JH
2976gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2977state->fd_in = cctx->sock;
2978state->fd_out = cctx->sock;
059ec3d9 2979
9d1c15ef 2980DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2981/* There doesn't seem to be a built-in timeout on connection. */
2982
2983sigalrm_seen = FALSE;
c2a1bba0 2984ALARM(ob->command_timeout);
17c76198 2985do
17c76198 2986 rc = gnutls_handshake(state->session);
f1fed05b 2987while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2988ALARM_CLR(0);
059ec3d9 2989
4fe99a6c 2990if (rc != GNUTLS_E_SUCCESS)
74f1a423 2991 {
60d10ce7
JH
2992 if (sigalrm_seen)
2993 {
2994 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2995 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2996 }
2997 else
452a164f 2998 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
c05bdbd6 2999 return FALSE;
74f1a423 3000 }
4fe99a6c 3001
dc6d1769 3002DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 3003
17c76198 3004/* Verify late */
059ec3d9 3005
899b8bbc 3006if (!verify_certificate(state, errstr))
74f1a423
JH
3007 {
3008 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
c05bdbd6 3009 return FALSE;
74f1a423 3010 }
059ec3d9 3011
17ba0f52 3012#ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
1c519e07
JH
3013if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3014 tlsp->ext_master_secret = TRUE;
17ba0f52 3015#endif
1c519e07 3016
f2de3a33 3017#ifndef DISABLE_OCSP
7a501c87 3018if (request_ocsp)
2b4a568d
JH
3019 {
3020 DEBUG(D_tls)
3021 {
3022 gnutls_datum_t stapling;
3023 gnutls_ocsp_resp_t resp;
3024 gnutls_datum_t printed;
e326959e
JH
3025 unsigned idx = 0;
3026
3027 for (;
3028# ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3029 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3030#else
3031 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3032#endif
3033 idx++)
3034 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3035 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3036 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3037 )
3038 {
3039 debug_printf("%.4096s", printed.data);
3040 gnutls_free(printed.data);
3041 }
3042 else
3043 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3044 if (idx == 0 && rc)
452a164f 3045 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
2b4a568d
JH
3046 }
3047
2b4a568d 3048 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 3049 {
74f1a423
JH
3050 tlsp->ocsp = OCSP_FAILED;
3051 tls_error(US"certificate status check failed", NULL, state->host, errstr);
7a501c87
JH
3052 if (require_ocsp)
3053 return FALSE;
3054 }
3055 else
3056 {
3057 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3058 tlsp->ocsp = OCSP_VFIED;
018058b2 3059 }
2b4a568d
JH
3060 }
3061#endif
3062
b10c87b3
JH
3063#ifdef EXPERIMENTAL_TLS_RESUME
3064tls_client_resume_posthandshake(state, tlsp, host);
3065#endif
059ec3d9 3066
4fe99a6c 3067/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 3068
9d1c15ef 3069extract_exim_vars_from_tls_state(state);
059ec3d9 3070
c05bdbd6
JH
3071cctx->tls_ctx = state;
3072return TRUE;
059ec3d9
PH
3073}
3074
3075
3076
17c76198 3077
059ec3d9 3078/*************************************************
17c76198 3079* Close down a TLS session *
059ec3d9
PH
3080*************************************************/
3081
17c76198
PP
3082/* This is also called from within a delivery subprocess forked from the
3083daemon, to shut down the TLS library, without actually doing a shutdown (which
3084would tamper with the TLS session in the parent process).
059ec3d9 3085
dec766a1 3086Arguments:
74f1a423 3087 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 3088 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 3089 2 if also response to be waited for
dec766a1 3090
17c76198 3091Returns: nothing
059ec3d9
PH
3092*/
3093
17c76198 3094void
74f1a423 3095tls_close(void * ct_ctx, int shutdown)
059ec3d9 3096{
74f1a423 3097exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
bd231acd 3098tls_support * tlsp = state->tlsp;
059ec3d9 3099
bd231acd 3100if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
3101
3102if (shutdown)
3103 {
dec766a1
WB
3104 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3105 shutdown > 1 ? " (with response-wait)" : "");
3106
c2a1bba0 3107 ALARM(2);
dec766a1 3108 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 3109 ALARM_CLR(0);
17c76198
PP
3110 }
3111
bd231acd
JH
3112if (!ct_ctx) /* server */
3113 {
3114 receive_getc = smtp_getc;
3115 receive_getbuf = smtp_getbuf;
3116 receive_get_cache = smtp_get_cache;
3117 receive_ungetc = smtp_ungetc;
3118 receive_feof = smtp_feof;
3119 receive_ferror = smtp_ferror;
3120 receive_smtp_buffered = smtp_buffered;
3121 }
3122
17c76198 3123gnutls_deinit(state->session);
ed62aae3
HSHR
3124gnutls_certificate_free_credentials(state->x509_cred);
3125
bd231acd
JH
3126tlsp->active.sock = -1;
3127tlsp->active.tls_ctx = NULL;
3128/* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
b1a32a3c 3129tlsp->channelbinding = NULL;
bd231acd 3130
17c76198 3131
b808677c 3132if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 3133memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
3134}
3135
3136
3137
17c76198 3138
0d81dabc
JH
3139static BOOL
3140tls_refill(unsigned lim)
3141{
3142exim_gnutls_state_st * state = &state_server;
3143ssize_t inbytes;
3144
3145DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
3146 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3147
f1fed05b 3148sigalrm_seen = FALSE;
c2a1bba0 3149if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
3150
3151do
3152 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3153 MIN(ssl_xfer_buffer_size, lim));
3154while (inbytes == GNUTLS_E_AGAIN);
3155
c2a1bba0 3156if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
3157
3158if (had_command_timeout) /* set by signal handler */
3159 smtp_command_timeout_exit(); /* does not return */
3160if (had_command_sigterm)
3161 smtp_command_sigterm_exit();
3162if (had_data_timeout)
3163 smtp_data_timeout_exit();
3164if (had_data_sigint)
3165 smtp_data_sigint_exit();
3166
3167/* Timeouts do not get this far. A zero-byte return appears to mean that the
3168TLS session has been closed down, not that the socket itself has been closed
3169down. Revert to non-TLS handling. */
0d81dabc
JH
3170
3171if (sigalrm_seen)
3172 {
3173 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 3174 state->xfer_error = TRUE;
0d81dabc
JH
3175 return FALSE;
3176 }
3177
3178else if (inbytes == 0)
3179 {
3180 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
bd231acd 3181 tls_close(NULL, TLS_NO_SHUTDOWN);
0d81dabc
JH
3182 return FALSE;
3183 }
3184
3185/* Handle genuine errors */
3186
3187else if (inbytes < 0)
3188 {
95f52235 3189 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
0d81dabc 3190 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 3191 state->xfer_error = TRUE;
0d81dabc
JH
3192 return FALSE;
3193 }
3194#ifndef DISABLE_DKIM
3195dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3196#endif
3197state->xfer_buffer_hwm = (int) inbytes;
3198state->xfer_buffer_lwm = 0;
3199return TRUE;
3200}
3201
059ec3d9
PH
3202/*************************************************
3203* TLS version of getc *
3204*************************************************/
3205
3206/* This gets the next byte from the TLS input buffer. If the buffer is empty,
3207it refills the buffer via the GnuTLS reading function.
817d9f57 3208Only used by the server-side TLS.
059ec3d9 3209
17c76198
PP
3210This feeds DKIM and should be used for all message-body reads.
3211
aded2255 3212Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
3213Returns: the next character or EOF
3214*/
3215
3216int
bd8fbe36 3217tls_getc(unsigned lim)
059ec3d9 3218{
0d81dabc 3219exim_gnutls_state_st * state = &state_server;
059ec3d9 3220
0d81dabc
JH
3221if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3222 if (!tls_refill(lim))
3223 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 3224
0d81dabc 3225/* Something in the buffer; return next uschar */
059ec3d9 3226
0d81dabc
JH
3227return state->xfer_buffer[state->xfer_buffer_lwm++];
3228}
059ec3d9 3229
0d81dabc
JH
3230uschar *
3231tls_getbuf(unsigned * len)
3232{
3233exim_gnutls_state_st * state = &state_server;
3234unsigned size;
3235uschar * buf;
059ec3d9 3236
0d81dabc
JH
3237if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3238 if (!tls_refill(*len))
059ec3d9 3239 {
0d81dabc
JH
3240 if (!state->xfer_error) return smtp_getbuf(len);
3241 *len = 0;
3242 return NULL;
059ec3d9 3243 }
059ec3d9 3244
0d81dabc
JH
3245if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3246 size = *len;
3247buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3248state->xfer_buffer_lwm += size;
3249*len = size;
3250return buf;
059ec3d9
PH
3251}
3252
0d81dabc 3253
584e96c6
JH
3254void
3255tls_get_cache()
3256{
9960d1e5 3257#ifndef DISABLE_DKIM
584e96c6
JH
3258exim_gnutls_state_st * state = &state_server;
3259int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3260if (n > 0)
3261 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 3262#endif
9960d1e5 3263}
584e96c6 3264
059ec3d9 3265
925ac8e4
JH
3266BOOL
3267tls_could_read(void)
3268{
3269return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3270 || gnutls_record_check_pending(state_server.session) > 0;
3271}
3272
3273
059ec3d9 3274
17c76198 3275
059ec3d9
PH
3276/*************************************************
3277* Read bytes from TLS channel *
3278*************************************************/
3279
17c76198
PP
3280/* This does not feed DKIM, so if the caller uses this for reading message body,
3281then the caller must feed DKIM.
817d9f57 3282
059ec3d9 3283Arguments:
74f1a423 3284 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
3285 buff buffer of data
3286 len size of buffer
3287
3288Returns: the number of bytes read
afdb5e9c 3289 -1 after a failed read, including EOF
059ec3d9
PH
3290*/
3291
3292int
74f1a423 3293tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 3294{
74f1a423 3295exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 3296ssize_t inbytes;
059ec3d9 3297
17c76198
PP
3298if (len > INT_MAX)
3299 len = INT_MAX;
059ec3d9 3300
17c76198
PP
3301if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3302 DEBUG(D_tls)
3303 debug_printf("*** PROBABLY A BUG *** " \
3304 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3305 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3306
3307DEBUG(D_tls)
3308 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
3309 state->session, buff, len);
3310
4896a319
AM
3311do
3312 inbytes = gnutls_record_recv(state->session, buff, len);
3313while (inbytes == GNUTLS_E_AGAIN);
3314
059ec3d9
PH
3315if (inbytes > 0) return inbytes;
3316if (inbytes == 0)
3317 {
3318 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3319 }
5fd28bb8 3320else
4896a319 3321 {
95f52235 3322 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4896a319
AM
3323 record_io_error(state, (int)inbytes, US"recv", NULL);
3324 }
059ec3d9
PH
3325
3326return -1;
3327}
3328
3329
3330
17c76198 3331
059ec3d9
PH
3332/*************************************************
3333* Write bytes down TLS channel *
3334*************************************************/
3335
3336/*
3337Arguments:
74f1a423 3338 ct_ctx client context pointer, or NULL for the one global server context